Bringing Our Clients’ Dream Features to Life: Risk Assessment Edition

The problem we kept running into

Every financial institution that banks cannabis and other high-risk accounts has to rate how risky each customer is. That rating is not a formality: it determines how closely an account gets monitored, how often it gets reviewed, and how well the institution can defend itself when an examiner comes knocking.

The tricky part is that these accounts are considered elevated from the start, whether they sit in a federally illegal, cash-heavy industry like cannabis or another profile that draws heavy scrutiny. So the real question was never whether an account is risky. It was how elevated that risk actually is once you account for the controls an institution has put around it.

For years, our clients were answering that question the same way: in custom spreadsheets that lived on someone’s desktop or shared drive, with weighted questions across licensing, ownership, negative news, transaction volume, and cash activity. Then they were hand-keying a single rating into Green Check, with none of the reasoning behind it coming along for the ride.

The rating showed up in our platform as a score with no story attached to it. When we looked closely, we realized we were storing the conclusion while all of the real work, the part an institution has to stand behind in front of its auditors and examiners, was happening somewhere we could not see or help with.

We started with your spreadsheets, not a blank page

When we decided to bring risk assessments into Green Check, we did not start by sketching what we thought a scoring tool ought to look like. We knew that whatever we built would only matter if it fit the way our clients already work.

So the first thing we did was ask institutions (specifically our Innovation Council members) to send us the risk assessments they run today. We wanted the actual working spreadsheets with every question, point value, and weight intact. Then we analyzed those files until we understood them…not just the math inside, but the entire process wrapped around them.

We talked through how each institution actually ran its process, down to the factors they weighed, how heavily they weighed them, and how often they revisited a rating. Every conversation added another version of the same core job, done a little differently. The more examples we collected, the more obvious it became that this was not a feature we could design from the outside looking in.

No two institutions rate risk the same way

The biggest thing we learned from all of those files is that there is no single formula everyone uses. There is no regulator handing one out, either. The agencies that oversee this work do not mandate a particular method. Instead, they require that whatever method an institution uses be documented, consistent, and explainable.

In practice, that means every institution has built its own approach over time, shaped by its portfolio, its examiners, and its own philosophy about what makes an account risky.

One institution might weigh licensing heavily, while another cares most about cash activity. One might score on a risk scale that maxes out at 40, while another runs all the way to 100. Even the cutoff where an account crosses from moderate-high into high sits in a different place at nearly every institution we looked at.

All of that variety could have been a reason to force everyone onto one rigid standard. We took it as the opposite and it became one of the most important requirements the product had to meet. A tool that only fits one institution’s math is a tool that most of our clients could never actually use, so we got to work on making it flexible.

A model flexible enough to hold all of it

Out of that research, we built what we call our proprietary weighted algorithm. The entire point is that it can reproduce any one of those client methodologies without asking the institution to abandon the approach it already knows how to defend.

An institution builds its own assessment, sets its own questions, decides how much each answer is worth, determines how much each question matters relative to the others, and draws its own rating bands for where low ends and high begins. Meanwhile, our algorithm handles the rest quietly in the background. The people filling out the assessment never have to think about the math.

The result stays consistent no matter how simple or elaborate a given institution’s assessment happens to be. That was the breakthrough we were really after, where a single standard can work across an entire portfolio even when every template underneath it looks different.

What mattered most to us was that the scoring stays explainable. An examiner does not just want to see a rating, they want to see how an institution arrived at it, so we built the methodology to be walked through step by step and passed on anything that would make the numbers faster to produce but harder to defend. A score you cannot explain is a score you cannot defend, and that shaped a lot of what we’ve built here.

Built with you, not just for you

None of this happened in a vacuum and the design went through round after round of pressure testing with the people who would actually have to use it. We ran group refinement sessions where our own team talked through the hard parts of the scoring model out loud. Just as importantly, we took the working designs back to the institutions themselves and asked them to tell us exactly where they would break. We iterated on the design (again and again) and validated our assumptions with our compliance team and our clients at every turn.

The client conversations, of course, led to some of the best parts of the feature. For example, you can launch a risk assessment from inside a monitoring review or account approval (coming soon), so the assessment and the review no longer live in two separate places.

All in all, our clients told us what mattered most, and we built against that feedback. The feature came straight from the people who live this work every day!

How it works now

From your side of the screen it is simple, even with a lot happening underneath:

• Build your assessment once, the same way you would in a spreadsheet. All assessments are versioned and tied to risk bands that your institution uses.
• Send it to yourself or another user to complete against the account. The moment it is done, the score is calculated and a new rating is applied and written back automatically.
• Every completed assessment is saved to a running risk history on the account: how the rating has moved, when, what drove it, and a link to the assessment behind it.
• Override a computed rating when you need to, with a justification, so the record stays complete.
• The full history is examiner-ready, with no digging through old spreadsheets to reconstruct how you got there.

The rating stops being a number with no story and becomes a documented decision you can actually defend.

Where this goes next

Bringing risk assessments into Green Check was never just about saving a few minutes, though it does that too. The real goal was to take one of the most critical pieces of compliance work, that previously lived in scattered spreadsheets and desktop files for years, and bring it into the platform where the rest of the account already lives.

Your methodology stays yours. Your scoring stays something you can explain. Green Check does the heavy lifting quietly in the background, so your team can spend its time on the judgment that actually requires a human.

We built this feature with our clients, start to finish. And that is exactly how we intend to build every high-impact feature that comes next.